Suppose we have a critical drain vulnerability that two whitehats find at the same time. One reports it to the bbp. Meanwhile when the report is being reviewed, the other whitehat executes a whitehat attack to secure the funds. Who gets the bounty 👀